fix: license-assistant detects private repos by isPrivate flag, not host

[bborbe]

What

license-assistant Step 0 inferred public/private from the git remote host, which misclassifies private Seibert-Data repos hosted on github.com as public.

Why

Host-based detection is wrong: the Octopus migration moved 73 private Seibert-Data repos onto github.com. Every license review on a private repo now fires MUST-tier LICENSE findings that block merges org-wide.

Surfaced 2026-08-18 on Seibert-Data/moco#5 — the review flagged 'no LICENSE file at repo root' as Should-Fix on a private repo.

Fix

Read the repo's own visibility flag — gh repo view --json isPrivate -q .isPrivate — per docs/go-licensing-guide.md § Public vs Private and matching scripts/rule-checks.sh (which already does this correctly). When visibility can't be determined, fire no licensing rule.

Tests

• make precommit on the branch
• Manual: gh repo view Seibert-Data/moco --json isPrivate → true

[ben-s-pull-request-reviewer]

Step 4c-sel CLASSIFY result:

Rule	Decision	Reason
agent-cmd/agent-frontmatter	Applicable	agents/license-assistant.md exists — MUST apply when an agent file is changed
agent-cmd/command-thin	Skipped	scope limited to commands/**/*.md; agent files are not command files
changelog/conventional-prefix-required	Applicable	CHANGELOG.md changed — rule is triggered by that exact filename
markdown-todo/lowercase-x-for-complete	Skipped	neither changed file contains any [ ] checkbox syntax
git-commit/feature-branch-no-tag	Skipped	@commits trigger means "check commit messages" — not triggered by diff file content
git-commit/imperative-mood	Skipped	same reasoning; applies to commit subjects, not to lines in CHANGELOG.md
git-workflow/never-direct-commit-to-master	Skipped	same; applies to commit discipline, not diff content

Step 4d-sel ADJUDICATE:

• agent-cmd/agent-frontmatter: agents/license-assistant.md frontmatter is complete and correct — name, description, model, tools, color, --- delimiters all present and properly formatted. No violation.

• changelog/conventional-prefix-required: CHANGELOG entry fix: license-assistant Step 0 visibility detection... correctly uses fix: prefix. No violation.

No mechanical findings (0 from ast-grep funnel). Citation validation is moot with zero adjudication findings.

---

PR Review: fix: license-assistant detects private repos by isPrivate flag, not host

Must Fix (Critical)

None.

Should Fix (Important)

None.

Nice to Have (Optional)

None.

---

Selector-mode traceability:

• Candidates: 7 rules matched by Step 4b-i glob filter
• Applicable: 2 rules (agent-cmd/agent-frontmatter, changelog/conventional-prefix-required)
• Skipped:
  • agent-cmd/command-thin → agent files out of scope for command-thin
  • markdown-todo/lowercase-x-for-complete → no checkbox syntax in changed files
  • git-commit/feature-branch-no-tag → @commits trigger means check commit messages, not diff content
  • git-commit/imperative-mood → @commits trigger; not a commit subject diff
  • git-workflow/never-direct-commit-to-master → @commits trigger; not diff content

Notes:

• The fix is well-scoped: changing only Step 0 detection logic in license-assistant.md to use gh repo view --json isPrivate instead of inferring visibility from the Git host. The security rationale is clearly documented — the Octopus migration moved 73 private Seibert-Data/* repos onto github.com, making host-based detection unreliable.
• The new fallback ("visibility unknown → skip rule entirely") is a strict improvement over the prior "assume public and continue" behavior — it avoids false-positive MUST-tier license violations that were blocking PRs org-wide.
• CHANGELOG entry is correctly formatted with fix: prefix.

---

{
"verdict": "approve",
"summary": "The fix correctly replaces unreliable host-based visibility inference with the authoritative `isPrivate` flag via `gh repo view`. The fallback to skip when visibility is unknown eliminates org-wide MUST-tier false positives from the prior behavior. Agent frontmatter and CHANGELOG entry are both rule-compliant.",
"comments": [],
"concerns_addressed": [
"correctness: visibility detection now uses authoritative `isPrivate` flag — `agents/license-assistant.md` lines 27-29",
"security: fallback to skip on unknown visibility eliminates false-positive MUST-tier license blocks for private repos on github.com — `agents/license-assistant.md` line 29"
]
}